CVE-2026-76360: Information Disclosure through Missing Authorization in the Health REST API in Splunk SOAR
In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not verify that the caller holds a role permitted to view system health and cluster state. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Monitor the health of your Splunk SOAR (On-premises) system (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-system-health-and-performance/monitor-the-health-of-your-splunk-soar-on-premises-system) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk SOAR (On-premises)to a version that resolves this vulnerability.Fixed in 8.6.0
Event History
Frequently Asked Questions
Which deployments are affected?
Splunk SOAR versions below 8.6.0 are affected. The issue applies to the Health REST API endpoint at /rest/health.
What access does an attacker need?
An attacker must be authenticated to Splunk SOAR, but does not need an assigned role. They can query the endpoint over the network without user interaction.
What information could be exposed?
The endpoint can disclose system and cluster telemetry that is intended to be limited to administrative or support users.
How can I determine whether my environment is exposed?
Check whether the Splunk SOAR version is below 8.6.0 and whether an authenticated account with no assigned role can access /rest/health. Successful retrieval of system or cluster health telemetry indicates exposure.